Skip to content

Security: Jyzzu08/SentinelOps

Security

SECURITY.md

Security Policy

Academic Lab Notice

SentinelOps is published as an academic and portfolio lab. It is not a production baseline and must not be deployed in real environments without hardening, secret rotation, TLS review, network controls and a backup policy adapted to the organization.

What Must Never Be Committed

  • real credentials, passwords, tokens or client secrets;
  • private keys, SSH keys or private certificates;
  • real .env files;
  • database dumps, backup archives or Restic repositories;
  • cookies, sessions or browser exports;
  • logs containing sensitive data;
  • screenshots showing secrets, private URLs or personal data;
  • unfiltered academic evidence packages.

Reporting Security Issues

If you detect a security problem in this public package, contact the author through:

Do not open a public issue with secret values. Report only the affected path, type of issue and reproduction context.

Safe Use Recommendations

  • Copy .env.example files to .env locally and keep them outside Git.
  • Generate unique credentials for every deployment.
  • Use real TLS and trusted certificates outside the lab.
  • Restrict administrative dashboards by network and identity controls.
  • Validate backups with non-destructive restores.
  • Review every screenshot and evidence file before publication.

There aren't any published security advisories